Ransomware vs DDoS

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

7% of reported cybercrime cases in Africa in 2025 involved ransomware or Banking Trojan stealers.

The highest ransom demand in Q2 2026 was $25 million.

Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.

The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.

41% of ransomware attacks exploited brand reputation.

35% of ransomware attacks exploited employee data.

31% of ransomware attacks exploited intellectual property.

Ransomware incidents made up over 20% of Cisco Talos Incident Response engagements this quarter, similar to just under 20% last quarter.

Threat actors maintained undetected access for approximately three days before ransomware deployment in the observed Sinobi engagement.

Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.

The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.

DNS-based attacks accounted for 34.3% of network-layer attacks in the first half of 2026.

CLDAP Floods surged 580% quarter-over-quarter and became the #3 attack vector in Q2 2026.

April 2026 peaked at 6.46 trillion HTTP DDoS requests and 165 petabytes of volume.

4% of reported cybercrime cases in Africa in 2025 involved DDoS attacks.

5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

More than 90% of DDoS attacks last less than 10 minutes.

DDoS campaigns now combine 50+ attack vectors and adapt in real time.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

DDoS attack volumes reached 12 Tbps in Q4, representing a sixfold increase.

Mexico, Brazil, and the United States accounted for 31%, 24%, and 20% of network-layer observed attack traffic, respectively.

64% of application-layer DDoS attacks exceed 10 minutes.

Telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024.

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.